Headline
RHSA-2022:6355: Red Hat Security Advisory: open-vm-tools security update
An update for open-vm-tools is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
Related CVEs:
- CVE-2022-31676: open-vm-tools: local root privilege escalation in the virtual machine
Skip to navigation Skip to main content
Utilities
- Subscriptions
- Downloads
- Containers
- Support Cases
Infrastructure and Management
- Red Hat Enterprise Linux
- Red Hat Virtualization
- Red Hat Identity Management
- Red Hat Directory Server
- Red Hat Certificate System
- Red Hat Satellite
- Red Hat Subscription Management
- Red Hat Update Infrastructure
- Red Hat Insights
- Red Hat Ansible Automation Platform
Cloud Computing
- Red Hat OpenShift
- Red Hat CloudForms
- Red Hat OpenStack Platform
- Red Hat OpenShift Container Platform
- Red Hat OpenShift Data Science
- Red Hat OpenShift Online
- Red Hat OpenShift Dedicated
- Red Hat Advanced Cluster Security for Kubernetes
- Red Hat Advanced Cluster Management for Kubernetes
- Red Hat Quay
- Red Hat CodeReady Workspaces
- Red Hat OpenShift Service on AWS
Storage
- Red Hat Gluster Storage
- Red Hat Hyperconverged Infrastructure
- Red Hat Ceph Storage
- Red Hat OpenShift Data Foundation
Runtimes
- Red Hat Runtimes
- Red Hat JBoss Enterprise Application Platform
- Red Hat Data Grid
- Red Hat JBoss Web Server
- Red Hat Single Sign On
- Red Hat support for Spring Boot
- Red Hat build of Node.js
- Red Hat build of Thorntail
- Red Hat build of Eclipse Vert.x
- Red Hat build of OpenJDK
- Red Hat build of Quarkus
Integration and Automation
- Red Hat Process Automation
- Red Hat Process Automation Manager
- Red Hat Decision Manager
All Products
Issued:
2022-09-06
Updated:
2022-09-06
RHSA-2022:6355 - Security Advisory
- Overview
- Updated Packages
Synopsis
Important: open-vm-tools security update
Type/Severity
Security Advisory: Important
Red Hat Insights patch analysis
Identify and remediate systems affected by this advisory.
View affected systems
Topic
An update for open-vm-tools is now available for Red Hat Enterprise Linux 8.2 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines.
Security Fix(es):
- open-vm-tools: local root privilege escalation in the virtual machine (CVE-2022-31676)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Products
- Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.2 x86_64
- Red Hat Enterprise Linux Server - AUS 8.2 x86_64
- Red Hat Enterprise Linux Server - TUS 8.2 x86_64
- Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.2 x86_64
Fixes
- BZ - 2118714 - CVE-2022-31676 open-vm-tools: local root privilege escalation in the virtual machine
Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.2
SRPM
open-vm-tools-11.0.0-4.el8_2.1.src.rpm
SHA-256: a33ab8341efd7366c52a5eec4d7131813c42a5e50308ad144792c97ec434e637
x86_64
open-vm-tools-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 2c959379d4b950d3533927fafcbece9844ce8e6d94876fad224fb2a816f7fec4
open-vm-tools-debuginfo-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 32384a16dccf46a0362e018c4f6a3b3e7dae16874db2e749a2a98de70bfeb1d4
open-vm-tools-debugsource-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 26f9237589cdaa5a34cc3ee217eb0e464203187e30e715f3c23b37b6dbaf1ee0
open-vm-tools-desktop-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 6be22e9188fa771e7fb7a88b83040a4bb52a9d178c717e96bbe8fdd94a640e65
open-vm-tools-desktop-debuginfo-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 95b89a993e30b5ed8685ca005f3df92b10faf48f80cc8a668bfb9a497663578c
open-vm-tools-test-debuginfo-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: c699d3303a14eea97c81c7d278e2f64d47dcf7643bd4d65d9ac8e34644c9bff2
Red Hat Enterprise Linux Server - AUS 8.2
SRPM
open-vm-tools-11.0.0-4.el8_2.1.src.rpm
SHA-256: a33ab8341efd7366c52a5eec4d7131813c42a5e50308ad144792c97ec434e637
x86_64
open-vm-tools-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 2c959379d4b950d3533927fafcbece9844ce8e6d94876fad224fb2a816f7fec4
open-vm-tools-debuginfo-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 32384a16dccf46a0362e018c4f6a3b3e7dae16874db2e749a2a98de70bfeb1d4
open-vm-tools-debugsource-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 26f9237589cdaa5a34cc3ee217eb0e464203187e30e715f3c23b37b6dbaf1ee0
open-vm-tools-desktop-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 6be22e9188fa771e7fb7a88b83040a4bb52a9d178c717e96bbe8fdd94a640e65
open-vm-tools-desktop-debuginfo-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 95b89a993e30b5ed8685ca005f3df92b10faf48f80cc8a668bfb9a497663578c
open-vm-tools-test-debuginfo-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: c699d3303a14eea97c81c7d278e2f64d47dcf7643bd4d65d9ac8e34644c9bff2
Red Hat Enterprise Linux Server - TUS 8.2
SRPM
open-vm-tools-11.0.0-4.el8_2.1.src.rpm
SHA-256: a33ab8341efd7366c52a5eec4d7131813c42a5e50308ad144792c97ec434e637
x86_64
open-vm-tools-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 2c959379d4b950d3533927fafcbece9844ce8e6d94876fad224fb2a816f7fec4
open-vm-tools-debuginfo-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 32384a16dccf46a0362e018c4f6a3b3e7dae16874db2e749a2a98de70bfeb1d4
open-vm-tools-debugsource-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 26f9237589cdaa5a34cc3ee217eb0e464203187e30e715f3c23b37b6dbaf1ee0
open-vm-tools-desktop-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 6be22e9188fa771e7fb7a88b83040a4bb52a9d178c717e96bbe8fdd94a640e65
open-vm-tools-desktop-debuginfo-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 95b89a993e30b5ed8685ca005f3df92b10faf48f80cc8a668bfb9a497663578c
open-vm-tools-test-debuginfo-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: c699d3303a14eea97c81c7d278e2f64d47dcf7643bd4d65d9ac8e34644c9bff2
Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.2
SRPM
open-vm-tools-11.0.0-4.el8_2.1.src.rpm
SHA-256: a33ab8341efd7366c52a5eec4d7131813c42a5e50308ad144792c97ec434e637
x86_64
open-vm-tools-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 2c959379d4b950d3533927fafcbece9844ce8e6d94876fad224fb2a816f7fec4
open-vm-tools-debuginfo-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 32384a16dccf46a0362e018c4f6a3b3e7dae16874db2e749a2a98de70bfeb1d4
open-vm-tools-debugsource-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 26f9237589cdaa5a34cc3ee217eb0e464203187e30e715f3c23b37b6dbaf1ee0
open-vm-tools-desktop-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 6be22e9188fa771e7fb7a88b83040a4bb52a9d178c717e96bbe8fdd94a640e65
open-vm-tools-desktop-debuginfo-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: 95b89a993e30b5ed8685ca005f3df92b10faf48f80cc8a668bfb9a497663578c
open-vm-tools-test-debuginfo-11.0.0-4.el8_2.1.x86_64.rpm
SHA-256: c699d3303a14eea97c81c7d278e2f64d47dcf7643bd4d65d9ac8e34644c9bff2
The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.
Related news
IBM Security Guardium 11.3, 11.4, and 11.5 could allow a local user to obtain elevated privileges due to incorrect authorization checks. IBM X-Force ID: 216753.
Dell VxRail, versions prior to 7.0.410, contain a Container Escape Vulnerability. A local high-privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the container's underlying OS. Exploitation may lead to a system take over by an attacker.
ISOS firmwares from versions 1.81 to 2.00 contain hardcoded credentials from embedded StreamX installer that integrators are not forced to change.
Red Hat Security Advisory 2022-6381-01 - The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Issues addressed include a privilege escalation vulnerability.
Red Hat Security Advisory 2022-6354-01 - The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Issues addressed include a privilege escalation vulnerability.
Red Hat Security Advisory 2022-6355-01 - The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines. Issues addressed include a privilege escalation vulnerability.
An update for open-vm-tools is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-31676: open-vm-tools: local root privilege escalation in the virtual machine
An update for open-vm-tools is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-31676: open-vm-tools: local root privilege escalation in the virtual machine
An update for open-vm-tools is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-31676: open-vm-tools: local root privilege escalation in the virtual machine
An update for open-vm-tools is now available for Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-31676: open-vm-tools: local root privilege escalation in the virtual machine
Ubuntu Security Notice 5578-2 - USN-5578-1 fixed a vulnerability in Open VM Tools. This update provides the corresponding update for Ubuntu 16.04 ESM. It was discovered that Open VM Tools incorrectly handled certain requests. An attacker inside the guest could possibly use this issue to gain root privileges inside the virtual machine.
An insider threat or remote attacker with initial access could exploit CVE-2022-31676 to steal sensitive data and scoop up user credentials for follow-on attacks.
Ubuntu Security Notice 5578-1 - It was discovered that Open VM Tools incorrectly handled certain requests. An attacker inside the guest could possibly use this issue to gain root privileges inside the virtual machine.
VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine.